Stripe webhook failing: 404, 307/308 redirect, timeout or 500

Stripe shows webhook deliveries Failed with 3xx, 4xx, 5xx or timed out? Point it at the exact final URL and respond 200 fast.

Reviewed October 14, 2026

What it means in plain English

Stripe tried to tell your app about a payment but your server didn't answer with success, so things like 'mark order as paid' never happen.

The endpoint URL is wrong (404) or still points at a preview/old domain.
The URL redirects (e.g. yourapp.com → www.yourapp.com, or trailing slash); Stripe treats any 3xx as a failure.
The route doesn't accept POST (405), or is behind password protection/auth (401/403).
Your code crashes (500) or does slow work before replying (timeout).

Stripe Workbench → Webhooks → your endpoint → Event deliveries; note the status code.
3xx: change the endpoint URL to the final address after redirects (exact domain, www or not, slash or not).
404/405: confirm the route exists in production (e.g. /api/stripe/webhook) and handles POST.
401/403: Stripe can't send custom headers. If Vercel Deployment Protection is blocking the endpoint, append ?x-vercel-protection-bypass=<secret> to the webhook URL. A custom production domain stays public under Standard Protection, but *.vercel.app URLs stay protected, and All Deployments protects the production domain too.
500: open your host's function logs to see the crash; often a missing env var.
Timeout: return a 200 immediately, then do heavy work afterwards/asynchronously.
Stripe retries for up to three days, so fixed endpoints will catch up; you can also resend events from the dashboard.

If the steps didn't clear the error, send what the screen says. A person can take a look. This is a request for a paid fix, not an instant chat.